Also all links are tracking links to http://click1.marketing.csid.com ... note they are plain http, of course. It's all so incompetently done I can only assume it's legitimate.